Just the basics: number of installs, activity of maintainers, the "feel" of their Github repository. I have never had the need (nor was I asked) to vet code in

Just the basics: number of installs, activity of maintainers, the "feel" of their Github repository. I have never had the need (nor was I asked) to vet code in depth before adding a dependency.